chore(spec): register the bare --apply's retirement in the ADR-0087 ledger (C7b S4 delta review)

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01USccGXR13sWyTeEwe8QFdH

Author: claude

.changeset/15211-cli-apply-reviewed-plan.md

@@ -1,12 +1,13 @@
 ---
 '@objectstack/cli': minor
+'@objectstack/spec': patch
 ---
 
 feat(cli)!: `os migrate organization-ownership --apply` executes only the plan the operator reviewed (ADR-0131 D10)
 
 Clause-②: yes (widening)
 
-<!-- adr-0087: not-required (no-migration-prescription) No metadata moves: no spec key, authorable spelling, object definition or stored shape is added, removed, renamed or re-shaped, and no exported declaration is removed or narrowed, so there is nothing for `objectstack migrate meta` to rewrite. What narrows is the accept set of one CLI command's writing mode: `--apply` without the reviewed plan file is refused, and the remedy is in the invocation an operator types (add `--plan-file`), never a rewrite of a package source or a stored row. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id is named or touched (not registered or already-registered); and nothing exported is removed or narrowed (not runtime-interface-only, type-surface-only or runtime-export-retired). -->
+<!-- adr-0087: registered cli-organization-ownership-apply-plan-file-required -->
 
 **BREAKING** (a narrowing of `--apply`'s accept set, released in 18.0.0-next.1), shipped as `minor` under the launch-window convention for breaking changes. It also widens the command: a new flag, `--plan-file`, new refusal reasons, and two new keys on the apply report.
 

packages/spec/src/migrations/entries/semantic/18.cli-organization-ownership-apply-plan-file-required.ts

@@ -0,0 +1,30 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import type { SemanticMigration } from '../../types.js';
+
+export const entry: SemanticMigration = {
+  id: 'cli-organization-ownership-apply-plan-file-required',
+  // No backticks in `surface`: build-upgrade-guide.ts renders it inside a code
+  // span AND a table cell.
+  surface:
+    'os migrate organization-ownership --apply, invoked without --plan-file (the bare --apply --backup-taken that '
+    + '@objectstack/cli 18.0.0-next.1 shipped, with or without --fate-supplement)',
+  replacement:
+    'Run the plan first, `os migrate organization-ownership --out plan.json` (with the same `--fate-supplement`, '
+    + 'under the same tenancy posture, against the same database), review the file it writes, then '
+    + '`os migrate organization-ownership --apply --backup-taken --plan-file plan.json`. A script or runbook that '
+    + 'applies directly gains the plan step and the flag; nothing in a package source or a stored row changes.',
+  reason:
+    'ADR-0131 D10 makes the ceremony an operator\'s act on a plan the operator reviewed. The apply computes its '
+    + 'own plan at apply time, and that plan\'s inputs can move between the review and the run: a different host '
+    + 'fate supplement, another release\'s inventory, another tenancy posture or another database. Planning with '
+    + 'one supplement and applying with another ran the second one\'s fates unreviewed, including a mirror deletion '
+    + 'the reviewed plan never listed. So the apply now reads the plan file the operator reviewed and refuses, before '
+    + 'anything is written, when its inventory digest, posture or database differs from the run\'s. Without the '
+    + 'file there is nothing to compare, so the bare invocation is refused.',
+  acceptanceCriteria:
+    'Every invocation of `os migrate organization-ownership --apply` passes `--plan-file` with the file a plan run '
+    + 'wrote, and the run reports `reviewedPlan`. A run that answers `plan-file-required`, `plan-digest-mismatch`, '
+    + '`plan-posture-mismatch` or `plan-database-mismatch` has written nothing: plan again, review, and pass the new '
+    + 'file.',
+};